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Abstract: We introduce a novel time-frequency quantum key distribution 
(TFQKD) scheme based on photon pairs entangled in these two conju- 
gate degrees of freedom. The scheme uses spectral detection and phase 
modulation to enable measurements in the temporal basis by means of 
time-to-frequency conversion. This allows large-alphabet encoding to 
be implemented with realistic components. A general security analysis 
for TFQKD with binned measurements reveals a close connection with 
finite-dimensional QKD protocols and enables analysis of the effects of 
dark counts on the secure key size. 
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1. Introduction 



Light and matter are ultimately constituted of quantum entities, so that the limitations of tech- 
nology cannot be prescribed by the principles of classical physics. Quantum-optical devices 



promise better-than-classical performance in sensing |IT]|2|, computation ElllllSl and, in par- 
ticular, communications ||6]|3. Quantum effects in optical systems are easily observed at room 
temperature because of the high carrier frequency of optical signals compared with thermal 
background radiation. Light has numerous degrees of freedom that can be co-opted for the 
transmission of quantum information, and optical signals can be generated and detected effi- 
ciently. Modern telecommunications leverage the very large capacity of optical channels via 
dense multiplexing techniques, and the efficiency of quantum information processing can be 
similarly enhanced with the use of large-alphabet encoding strategies. In this connection, time- 
frequency encoding offers numerous advantages over polarisation or spatial-mode encodings, 
since multiple spectral modes are supported in waveguides and optical fibres with minimal dis- 
persion, and zero cross-talk. For this reason, large-alphabet spectral-temporal multiplexing in 
quantum optics has recently received growing attention [8, 9 |, with immediate applications in 
quantum key distribution (OKD) lfTOlll llfT2l . 

Public key cryptography underpins much of commerce today 1 13], but it is threatened by the 
advanced computational tools made possible by quantum information processing. Although a 
quantum computer remains many years away, the threat is sufficient to motivate the search 
for security that is immune to a quantum adversary. Quantum key distribution |14| provides 
this security, and in the three decades since the first proposals were made based on polarized 
photons 1 15 1, it has developed into both a burgeoning industry 1 16 1, and a diverse research field 
lITTlfTSl flQ 20 1 . While polarisation states are vulnerable to corruption in waveguides and optical 
fibres, the arrival time of photons is a more robust encoding |21 1. In general, transmission losses 
limit the range of QKD, but the use of entangled photons 1 22 1 allows the distance to be extended 
by means of quantum repeaters Ii23l[24l . which employ entanglement swapping between short 
segments to distribute secure correlations over large distances. 

These considerations motivate the study of QKD with photon pairs entangled in their chrono- 
cyclic degree of freedom |25] |26l |22l ES HI] |8 1. The security of such time-frequency QKD 
(TFQKD) protocols is based on the ability to detect non-classical correlations in at least two 
complementary measurement bases, and these bases should be mutually unbiased (i.e. Fourier 
conjugates of one another) to maximise the sensitivity of the measured correlations to intru- 
sion by an eavesdropper Time and frequency domain detection provides a particularly con- 
venient conjugate pair both because time- and frequency-resolving measurements are mature 
technologies, and because photon sources based on parametric scattering, such as spontaneous 
downconversion or four-wave mixing naturally produce photon pairs with widely-tunable cor- 
relation properties ranging from uncorrected emission lISOllSTI to extremely broadband spectral 
entanglement |[32l |33l [34 1 . However, accessing the large entropy of these photon pairs requires 
precise measurements in both time and frequency bases, which is a non-trivial problem because 
of technical constraints on the timing jitter of photon detectors and the resolution of spectrom- 
eters. 

Recently it was proposed to use fast time-resolving photon detectors to record the correlated 
arrival times of entangled photons, and to insert a dispersive medium before the detectors to 
measure in the frequency basis flOl . The dispersion delays each spectral component of the in- 
cident photons differently, converting the arrival time at the detector into a frequency measure- 
ment ll35l . This protocol has the advantage that a single detector can sample a large region in 
chronocyclic space |36 1. However the timing jitter of the detector sets a lower limit to the cor- 
relation time of the photon pairs. Fast detectors are not yet efficient ll37l[38l . whereas efficient 
detectors are generally slower ||39l |40l |4T1| . so with current technology the spectral correla- 
tions should be very narrowband in order for the arrival-time correlations to extend over a long 
enough period to be resolved by the detectors. Besides the challenges of engineering a bright 
photon source to fit these criteria, the narrow bandwidth also means that extremely dispersive 



media are required to implement the frequency measurements, which are generally lossy. It was 
found in flOl that a photon efficiency of up to 2 bits per photon could be achieved with realistic 
components. 

Here we introduce an alternative large-alphabet entangled TFQKD protocol that is dual to 
ifTOl . We propose to use spectral measurements to detect frequency correlations, and to use 
phase modulators to convert these measurements to the time basis. We show that with this de- 
tection scheme it is feasible to demultiplex up to 4 bits per photon with readily available com- 
ponents, while technical advances — essentially improving the power dissipation of electro- 
optical phase modulators to allow larger modulation depth — could allow much larger alpha- 
bets. While chronocyclic entanglement produces correlations between the continuous variables 
of arrival time and frequency, measurements inevitably map these correlations to a set of dis- 
crete outcomes. We provide a security analysis that accounts for the effects of this detector- 
binning, and we model the constraints on the secure key arising from dark counts. 

2. The protocol 




Fig. 1. Time-frequency quantum key distribution with spectrally entangled photon pairs. 
Top: we assume a Gaussian anti-correlated joint spectral amplitude /(to, Co') (left) and a 
corresponding positively correlated Gaussian arrival time distribution f(t,t') (right). Black 
ruled lines indicate spectral/temporal measurements made by Alice and Bob centred at the 
values {cOj}/{tj} (see text). Middle: photon pairs from the source are distributed to Alice 
and Bob, who have identical measurement setups. Bottom: spectral correlations are re- 
vealed with photon-counting spectrometers (spect). Security is certified by measurements 
in the conjugate arrival-time basis using time-to-frequency conversion (TFC), which is im- 
plemented with a dispersive element (disp) followed by a phase modulator (mod). 



Key distribution aims at generating a pair of correlated random bit strings shared exclusively 



by two parties — conventionally called Alice and Bob — that can be used to encrypt and 
decrypt communications by means of a one time pad ll42l . In our TFQKD protocol, Alice and 
Bob construct correlated bit strings by recording the results of joint measurements on pairs of 
spectrally entangled photons. The entanglement produces correlations in both the frequencies 
and the arrival times of the photons which are destroyed if the system is measured by a third 
party. Uncorrelated measurement results therefore reveal the presence of an eavesdropper (Eve) 
when Alice and Bob compare a subset of their bits. As shown in Fig. [T] a parametric source 
(which may or may not be under the control of Eve) produces photon pairs in the entangled 
state (ignoring for the moment the emission of vacuum or double pairs) 

W)= jj f{(o.co')\(o,co')dcod(o', (1) 

where |a),a)') indicates a photon pair received by Alice and Bob with frequencies O) + Oq 
and (£)' + Oo, respectively, with coq the central frequency of the pair. Here /(a), (o') is the joint 
spectral amplitude describing the frequency correlations between a photon pair emitted with 
detunings o, O)' from degeneracy. In general, energy conservation and phasematching consid- 
erations produce non-factorable joint spectra, /(ft), (£)') 7^ ff^{(o)fQ{o)') B3ll44l . and the degree 
of entanglement — the number of correlated spectral modes — is conveniently quantified by 
the Schmidt number K = l/Y.jXj, where the {Xj} are the singular values of /. Broad spectral 
entanglement with K ^ 10^ has been observed B3]| and routes to extremely multimode emission 
with K ^ 10^ have been proposed 1341 . Therefore although source engineering is non-trivial, it 
is akeady possible to produce photon pairs with a high degree of quantum correlations. As dis- 
cussed above, the primary challenge for implementing TFQKD lies with the detection scheme. 
In our protocol, Alice and Bob each have a photon-counting spectrometer, which they use to 
measure the frequencies of their photons. A photon entering one of the spectrometers is spa- 
tially dispersed and then directed towards one of M photon counting detectors, such that a 
'click' at the detector (7 = 1,2, .. . ,M) is described by a projective positive operator-valued 
measure (POVM) element 

n; = / Fj{co)\co){(o\d(o. (2) 



Here Fj is the instrument response that represents the finite resolution of the spectrometer — 
that is, the range of frequencies coupled to the detector. For simplicity in the calculations to 
follow we will assume a 'top hat' profile 

with (Oj = C0q + [J — (M+ l)/2]5co. This describes a spectrometer with a resolution 5co and a 
flat response to all frequencies in the range coq — Aco /2 < co < CO0+ Aco /2, where Aco = M5co. 
This description would be appropriate for a grating spectrometer equipped either with a photon 
counting charge-coupled device (CCD), or a v-groove array of fibres coupled to Geiger-mode 
avalanche photodiodes (APDs), for example f46\. The entanglement of the state in Eq. ([T]l will 
cause correlated clicks at the outputs of Alice's and Bob's spectrometers, which they can use to 
generate a cryptographic key. The frequency measurements have M possible outcomes, so that 
a detection event can extract up to a maximum of Im — log2 M bits of information from each 
photon pair. 

However to certify the security of their key, they need to also check that the arrival times of 
the photons are correlated. As mentioned previously, the large timing jitter (>200 ps for APDs) 
of efficient photon-counting detectors makes it challenging to resolve the temporal correlations 



directly. Instead, we propose to implement measurements in the time basis by sending each pho- 
ton through a time-to-frequency converter Il47ll48ll49l . As shown in Fig.[T] this comprises a dis- 
persive element followed by a phase modulator, the combined effect of which is to implement 
a Fourier transform on the incident waveform, thus converting time to frequency. The effect is 
rigorously analogous to a spatial Fourier transform implemented on the transverse profile of a 
light field using a lens followed by free-propagation over a distance equal to its focal length. To 
see how this works, consider first the effect of the phase modulator on an incoming field (anal- 
ogous to free propagation alone). The modulator imprints a sinusoidally time- varying phase 
<^(f) — Acos,{Q.t) with amplitude A and angular frequency £2. Near the peak of the modulation 
at f « the phase has a quadratic time dependence (f ) « — = — 0f^/2, where we have 
defined ^ = AO? and we dropped an unimportant global phase. The time-dependent amplitude 
E{t) of the incident field is transformed to E{t) exp{i^f^/2}, which in frequency space induces 
a transformation analogous to the Fresnel-Kirchhoff diffraction formula, 

lo)) (2ra0)-i/2|^i(ffl-<B')-/20 (4) 

We now consider that the field has previously propagated through a system with quadratic, 
or group velocity dispersion, which imparts a spectral phase ^(o) = — ^"a)^/2 (analogous 
to a lens). Inserting this phase and multiplying out the Gaussian exponent in Eq. Q, the full 
transformation becomes 

1 0)) (2;ri0)-i/2ei"V2^' j gi(i/^-,>'>'V2g-i<««7^i | oj') do)'. (5) 

The choice (p" = 1/0 corresponds to the spectral Fraunhofer limit f5V\ in which the quadratic 
phase factor in the integrand of Eq. (j5]l is removed, and the transformation is then operationally 
identical to a Fourier transform (the analogous cancellation of Fresnel diffraction in the focal 
plane of a lens is well-known). That is, any measurement of the spectral intensity of the trans- 
formed field is equivalent to a measurement of the temporal intensity — the arrival time — of 
the input field, described by the POVM element 

Uj = {27t^)-^^^ J I Fj{a)-a)')\(o){a)'\do)da)', (6) 

where we have defined 

Fj{x) = {2n^)-^l^ j Fj{x')e-^'-'l^dx' (7) 

= 8(0{2Kii))-^l^e-'"^'^lhmc{x5(0/2!i>). (8) 

The temporal resolution of this measurement is dt ^ 5co/^, where 5(0 is the spectral resolution 
of the photon-counting spectrometer, as described above. Note that this is independent of the 
timing jitter of the photon counters used to register the photons. Like an ordinary spatial lens, 
the time lens has a finite aperture T, which is the region in time over which the phase modulation 
remains quadratic. To a good approximation this is given by T = l/il ll47l . This sets a limit to 
how fast the modulator can be run, since the signals to be detected must pass through the 
aperture within this time window. 

Having described how to implement temporal measurements, we consider the parameters 
required for an effective TFQKD protocol using our approach. As an idealised example, we 

' Other phase modulation schemes such as four- wave mixing in waveguides fSO] or sum-frequency generation in 
nonlinear crystals 1 48 1 could of course be used. Here we consider electro-optic phase modulation, which can be imple- 
mented with off-the-shelf telecoms components efficiently and with low loss. 



assume a Gaussian correlated joint spectrum of the form 1521153)1 



/( 0) , 0)' ) = ( A+ A_ / 8 ) " ' /2 exp ( - 0)! /2 - «^ /2A2 ) , (9) 

where co± = (o) ± (o')/^/2 and A+, A_ are the marginal and correlation bandwidths, respec- 
tively. The Schmidt number is given by 2K — A+/A_ + A_/A+, which is roughly the ratio 
of the major and minor widths of the joint spectrum (see Fig. [TJ. This coincides with the in- 
tuition that the number of correlated modes is found by dividing up the joint spectrum and 
counting the number of bins of width roughly equal to the correlation bandwidth A_. To access 
these correlated modes with our detectors, we engineer the source such that A_ = j3 5(0 and 
A+ = jS+Ao, where the constants j3± are chosen so that the spectral resolution roughly matches 
the correlation bandwidth, and the spectral response covers the full width of the joint spectrum. 
For example, the choice /3+ = 3/4 yields a reasonably flat marginal probability distribution 
across all detection channels, while choosing j3_ = 1/5 provides sufficiently tight correlations 
that cross-talk between channels is negligible. 

The correlations in the time domain are determined by the joint temporal amplitude /(f ,f'), 
which is the two-dimensional Fourier transform of the joint spectral amplitude, /(ft), ftj'). The 
form assumed in Eq. ^ is convenient because f{t,t') is again a correlated Gaussian as shown 
in Fig. [T| with major and minor temporal widths given by 7± = 1/A:p. If we require the same 
ability to resolve temporal correlations as spectral correlations, we should have a temporal 
resolution 5f = r_/j3_, which fixes the modulator phase curvature to be 

5ft) 

^ = 57 

= A_A+ 

= l5+p-M5o)^. (10) 

We also require that the temporal aperture of the modulator is long enough to accommodate the 
full signal, T > r+, which limits the modulator frequency to 

D.<l5-5co. (11) 

Since the modulation frequency is restricted, the modulation depth A must be large enough to 
achieve the required phase curvature. The demands on the modulation depth are minimised by 
matching the modulator frequency and the spectrometer resolution to achieve equality in the 
above condition. This can be achieved with modern GHz-bandwidth modulators and a rela- 
tively modest grating spectrometer For instance, using the choices for j3± introduced above, 
a 50 GHz modulator could be used with a 2 nm-resolution spectrometer and telecoms-band 
photons. Operating at this limit, the modulation depth required to implement the time lens is 

A = ^M. (12) 

This is a relatively demanding condition: the modulation depth must rise in proportion to the 
number of frequency bins used for the QKD protocol. That is, exponentially in the number of 
bits carried by each photon pair However modulation depths of order 207r radians are feasible 
with lithium-niobate modulators ll54ll . which would allow M = 16 (an alphabet size of = 4 
bits per photon pair). We note finally that the dispersion required to reach the Fraunhofer limit 
in this example would be provided by ^220 m of ordinary silica fibre, with a GVD on the order 
of 300 fs^ cm^' . Such a short length of fibre would introduce very small losses. 



3. Security 



The output of TFQKD is a digital bit string, as for all QKD protocols, but this is extracted 
from measurements on continuous degrees of freedom. Therefore it is not immediately obvi- 
ous whether a security analysis developed for discrete-variable QKD protocols can be applied. 
To examine the security of TFQKD with entangled photons, we adapt arguments developed 
for spatially-encoded QKD 1551 to the case of finite detector resolution ll56l l57l l58l [59l . To 
proceed, we consider the correlations revealed by the sifted joint probability distribution {pf^} 
describing the probability of Bob's detector firing along with Alice's a* detector, when both 
measure in the frequency basis. These correlations are quantified by the mutual information Iba, 

/BA = Wl0g2(^), (13) 
ba \PbPa / 

where = Y-aPfa marginal distribution of Bob's outcomes, and where is similarly 

Alice's marginal distribution. For simplicity we suppose that Alice and Bob post-process their 
sifted key bits using a one-way forward reconciliation protocol, for which the size — in bits — 
of the secret key they can distill is bounded by the excess information 

I = ^BA — ^BE, 

where Ibe is the mutual information between Bob and Ev^ We can calculate /ba from the 
statistics of Alice's and Bob's measurements but /be is not known and must be bounded by 
analyzing the correlations in the complementary (temporal) basis. To proceed, we write the 
mutual information in the form /xy = Hx — //x|y P^l, where Hx = —T.xP^^'^EiP^ 
marginal entropy and where the conditional entropy is given by 

Hx\Y=J^PyHx\Y=y, Where Hx|y=, - -E/'^Jlog2/'^J (14) 

V X 

is the entropy associated with the conditional probabilities p^J that the detector of party X 
fires, given that the detector of party Y fires. We then obtain 

^ = ^B|E^^B|A- (15) 

Next we need to find a lower bound for //b|e- To do this, we note that the variability of Bob's 
measurement results in time and frequency are restricted by Heisenberg's uncertainty principle. 
More generally, if Bob receives an arbitrary quantum state p, the marginal entropies //b(p) 
(//b (p )) for Bob's measurements in frequency (time), satisfy the entropic uncertainty relation 

Hb{p)+Hb{p)>B, (16) 

where B is a number that depends only on Bob's measurements, not on the state p. Alice's and 
Eve's measurements on the state emitted by the source produce a conditional state PB|A=a,E=e 
Bob's detectors, so that we have {pB\A=a.E=e) = ^b|a=o.e=p> using a natural tripartite exten- 



sion of the notation in Eq. ( 14 1. Substituting this conditional state into Eq. ( 16 1 and averaging 



over the possible outcomes of Alice's and Eve's measurements, we obtain 

^BlEA +^B|EA > ^- (17) 



^In general the key distillation will have non-unit efficiency j3 such that / = j8/ba — 'be- However high efficiencies 
can be achieved, with p > 90%, so that this represents a small coirection. In any case, although the formulas are 
simplified by assuming j3 = 1, our security analysis can be trivially extended to cover the general case. 



Now, since uncertainty (entropy) is only increased by removing a "given" precondition from a 
conditional distribution, we can remove Alice as a given from the first conditional entropy, and 
Eve as a given from the second, to get 



Inserting this into Eq. ( 15 i gives 



^B|E+^B|A >B. 



The formula for the entropic bound is 



B = -21og2C, 



(18) 



(19) 



(20) 



where C ■ 



in'./^nJ/^i 



maXy^ I 11^' I loo, with | |A| |oo denoting the largest singular value of the operator 
A ll60l . This bound is how the complementarity of the temporal/spectral measurement bases 
underpins the security of the key. As shown in Appendix [A] C is well approximated by the 
quantity 5(£)5t /2n, so that finally the size of the secret key is 





27t 




Hb>I> min |flB,log2 


-^B|A 


dco5t 



B A 



(21) 



where we have included the natural constraint that the secret key is upper bounded by the 
marginal entropy of the measurements (since //b|e < ^^b)- That is, regardless of the measure- 
ment precision, the secret key cannot exceed the entropy of Bob's marginal statistics. This is 
in turn bounded from above by <Im = log2M, which is the maximum information content 
for M-outcome measurements. By design M — (/3+/2/3_)A' is roughly equal to the Schmidt 
number of the source, to within a factor on the order of unity. With appropriate choices of j3± 
and for sufficiently resolving measurements (such that 8(o8t ^ M^'), this protocol can there- 
fore be efficient in terms of the information extracted from the quantum states it consumes as 
a resource. For the modulation scheme described above, we have 8t ~ 5a) which along 
with Eq. ( lOi indeed yields 8co5t = (j3+j3_M)^'. However we note that Eq. (21 1 is a general 
expression for the size of the secret key for a TFQKD protocol with arbitrary finite resolution 
in both the time and frequency bases, which is not specific to our proposed modulation scheme 
and makes no assumptions about the form of the state produced by the source, or the power of 
Eve's interventions. 



4. Practical considerations 

So far we have considered the security of finite-resolution measurements on photon-pair states, 
but the real photonic states emitted by a parametric source contain dominant contributions from 
vacuum (no photons emitted), and smaller contributions from multi-pair emission (most signifi- 
cantly, four photons emitted instead of two). Multi-pair emission does not necessarily represent 
a security threat, since in general the spectral correlations of the source are strictly pair-wise, 
meaning that Eve cannot glean extra information by 'splitting off' extraneous photons. How- 
ever our security proof is based on a representation of the POVMs in the Hilbert space spanned 
by a single photon impinging on each detector The proof is therefore only approximate, but 
squashing protocols have been proposed for qubit-based QKD to deal with the effects of multi- 
pair emission lISTI . and a similar idea could be used here by randomly assigning measurement 
outcomes whenever more than one detector in an array fires. 

Alice and Bob can remove the influence of the vacuum components by post-selecting on joint 
detection events, and this also allows the protocol to run when the channel transmission and de- 
tector efficiencies are less than unity. For Alice and Bob to use postselection, they must employ 



spectral filters and temporal gates that prevent signals entering their detectors with spectral or 
temporal components outside the range of their measurements. To see why, suppose that Eve 
is capable of performing a very precise projective (non-destructive) frequency measurement on 
Bob's photon. If he goes on to measure in the frequency basis, he will get the same result as 
Eve, and if Alice also used the frequency basis, this measurement result will form part of the 
sifted key. However, if Bob makes a temporal measurement without any time gate, the narrow- 
band photon produced by Eve's measurement will fall mostly outside of Bob's detection range 
in the time domain, and so will not be detected. Alice and Bob therefore discount this event, 
since they are post-selecting events where both parties receive a photon. Mutatis mutandis Eve 
can make the same kind of intercept-resend attack in the temporal basis. In this way. Eve can 
gain perfect knowledge of the sifted key, while forcing Alice and Bob to ignore those events 
where she failed to choose the correct measurement basis. Alice and Bob can prevent this attack 
by always rejecting photons occupying regions of chronocyclic space outside the sensitivity re- 
gions of their detectors, by means of spectral filters and temporal gates ||25l . In our proposed 
protocol this could be accomplished with a combination of a dielectric stack and a Pockels cell 
preceding each of Alice's and Bob's detection systems. See ll59l for a more general discussion 
of the effects of finite detection range on entanglement verification. 

With postselection as described above, non-unit efficiencies and losses do not directly affect 
the security, but they reduce the key exchange rate which increases the fraction of uncorrected 
dark counts. As is the case with all other QKD protocols, the increasingly important role of 
dark counts as channel losses grow ultimately limits the distance over which TFQKD can be 
run securely ||62iri0 55 1. To analyse this limitation we consider a simple error model in which 
the source joint spectrum produces perfect correlations at Alice's and Bob's detectors, while 
random errors occur with probability p in either the time or frequency measurements, so that 

Pt^=[{l-P')5ha+P'/M]/M, (22) 

where = Mp/{M — 1). With a dark count probability d for each of the M detectors in any 
given run of the photon source, the error probability is found to be (see Appendix[B]i, 

p^— '-■ where ^+Mt/Ml + ^ . (23) 

' kM+1 7] \ erj^ J 

Here Tj = rjchan^Jd^ with Tjchan — e^^/^"" the transmission through a quantum channel of length 
L and attenuation length Latt and Tj^ the overall detector efficiency, assuming Alice and Bob 
have identical equipment. We have also introduced the photon-pair emission probability e such 
that the quantum state emitted by the source is approximately given by |0) + ^/e\\lf), with 
|0) the vacuum state and Ixj/) given in Eq. ([T]) (see part (a) of Fig. |2|i. Note that in a typical 
implementation with M ^ I and { Tj , e } <C 1 , with a small dark count probability d ^r\£ /M, 
we have p' pKi IMd/rj. With the error model in Eq. p2| ) the conditional entropies are both 
given by 

^B|A=//B|A = pl0g2(M-l)+/l(p), (24) 

where h{x) = — xlog2X— (1 — .Ji:)log2(l — x) is the binary entropy. Substituting these expressions 



into Eq. (21 1, using 5a)5f = l/j3+)3_M, one obtains 

I>lM-2p\og2iM-l)-2h{p)-c, (25) 

where we have defined the 'binning deficit' c = — log2(2;rj3+j3_). The security condition/>0 
is of the same form as that derived in 1631 . which considered QKD with finite dimensional 
quantum systems [64|^ Therefore we see that TFQKD, based on the continuous chronocyclic 

^Eq. (27) in |63 J corresponds to setting / = with c — > 0, M — > N and p — !■ . 



degree of freedom, can be treated as a finite-dimensional QKD protocol, with a small correction 
factor represented by c, that takes account of the choices made in binning the measurements. 

A realistic joint spectrum, as approximated in Eq. (|9]), will not exactly produce the simplified 
delta-correlated outcome distribution in Eq. (j22]i; in general there will be some finite cross-talk 
between adjacent detection channels and a Gaussian-like variation in the marginal detection 
probabilities. However we have verified numerically, using Eq. (j9]), that the choices j3+ — 3 /A, 
/3_ = 1/5, which we introduced previously, generate Hq I^, and agree with Eq. (24i, to 



within 0.05 bits, so that Eq. ( 25 1 is approximately correct even for a source with a realistic joint 
spectral amplitude. 
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Fig. 2. TFQKD in the presence of losses and noise, (a) The source emits mostly the vacuum 
state 1 0) , with e the small probability to emit a correlated photon pair. For simplicity we 
consider the source located equidistant from Alice and Bob, connected by lossy channels 
of length L with attenuation length Latt- The photon detectors comprising the spectrometers 
have efficiency Tjj and suffer dark counts with probability d. (b) We compute the secure key 
size / as a function of the alphabet size Im for a typical protocol with e = 0.1, rid = 25% 
(including coupling losses) and d = 10^^, at a distance L = L^a- Dark counts cause a sharp 
drop in the secure key size for alphabets larger than 1 1 bits. 



Part (b) of Fig.|2]shows the variation of the secure key size / on the size 1^ of the alphabet for 
a typical implementation with APD-type detectors and a channel length with L — Latt (typically 
^20 km in the C-band), assuming the values of )3± used previously. The secure key initially 
grows in proportion to the alphabet, albeit with a magnitude reduced by the binning deficit 
c w 0.086 bits. Here the deficit is small enough that exchanging up to 4 secure key bits per 
detected photon pair remains feasible with the components described previously. However for 
/m > 1 1 (i.e. M > 2048) the secure key decreases and rapidly falls to zero, since the dark count 
rate from the growing number of detectors causes significant errors that are attributed to Eve. 
This calculation exemplifies a natural technical trade-off in TFQKD, where information can be 
extracted rapidly from photon pairs using detector arrays as we propose here, whereas single- 
detector protocols extract less information per registered photon pair, but are affected much less 
by dark counts I.IOJ . 

5. Conclusion 

We have described an implementation of highly multiplexed time-frequency quantum key dis- 
tribution using photon-counting spectrometers and phase modulators to implement frequency 
and arrival-time measurements on pairs of spectrally correlated photons by means of time-to- 
frequency conversion. We analysed the technical demands required for such a protocol and 



found that a large-alphabet detection system is feasible with commercially-available compo- 
nents. We developed a general security analysis for continuous-variable QKD protocols with 
binned measurement results, and applied it to our protocol to model the effects of dark counts 
on the size of the secure key. The protocol we presented is one of a family of time-frequency 
protocols well suited to transmission using waveguides and optical fibres, where spatial or po- 
larisation mode encoding is vulnerable to cross-talk and differential scattering losses. Highly 
multimode quantum light sources are now a well-developed technology, and the use of entan- 
gled beams allows the communication distance to be extended via entanglement swapping with 
quantum repeaters. Our measurement scheme based on phase modulation represents a compact 
and technically straightforward way to demultiplex a large-alphabet key from a multimode en- 
tangled light source, which is a convenient source of correlations that removes the need for an 
active encoding step. The security analysis we presented shows how the protocol can be treated 
as a finite-dimensional QKD scheme, despite the continuous nature of the chronocyclic de- 
gree of freedom. We anticipate that these results will influence the next generation of quantum 
cryptographic systems. 



A. Entropic uncertainty relation for finite-resolution measurements 



(27r^)- 





Fig. 3. Schematic of the operator Tlj ITj. , showing the approximate computation of its 
largest singular value. 



As desciibed in the main text, the complementarity of non-commuting measurements 
{nj},{n<.} is manifested by the entropic uncertainty relation in Eq. (16 1, with the bound 



1/2 — 1/2 1/2 — 1/2 

B — —2\og2ma\ ji^\\Tl J | |oo. To compute the singular values of the product ny 11^,' we 

first note that the square-roots can be dropped because for the top-hat-shaped frequency bins 
defined in Eq. ^ we have F(a))'/^ — F{a)). We therefore consider the singular values of the 
operator 



^ 27t(p 
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(26) 
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Sine 



5(0 jco' - CO") 
2 
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The phase factor e can be dropped since this represents a unitary transformation 



that does not affect the singular values. Similarly the index /' on Fj is arbitrary since this pa- 
rameterises a shift in the position of the top-hat function that again does not affect the singular 
values. The singular values are thus obtained by considering the Schmidt decomposition of the 
two-dimensional function 



Sa (m'-a") 
2 ^ 

otherwise. 



\(0'-(0j\< 8(0/2; ^27) 



As shown in Fig. this has the form of a narrow vertical strip cut from a broad diagonal 
band, and is well approximated by the factorable function ^(o)',©") ~ Xf{(o')g{(o"), where 
/(o') is a mode function with width 5(0, g{(o") is a mode function with width 2n(^/5(0, and 




(28) 

Numerical calculations confirm that this remains an excellent approximation to the largest sin- 



gular value of the function in Eq. (27 1 provided 5(o/{27t<j) /5a)) < 0.1, which is guaranteed by 



Eq. ( 10 1 for a large-alphabet protocol with M > 1 7)3+ j3_. Substituting Eq. (28 i into Eq. (20 1 



and using 5f = 5(b/^, we obtain the bound on the secret key given in Eq. (21 1. We note that the 
resulting bound applies quite generally to any TFQKD protocol employing binned frequency 
and time measurements with resolutions 5(0, 5t. 

B. Dark count error probability 

The error probability p is given by f63l 

^nmrrprt 



where Pcomcu ^incorrect ^re the probabilities for recording correlated and uncorrected detector 
clicks, respectively. Alice and Bob postselect on single clicks at each side, so only events where 
one detector fires each are counted. We make the simplifying assumption that if both photons 
from a photon pair are successfully emitted and detected, without a dark count occurring in any 
other channel, then the two registered outcomes are perfectly correlated. If these photons are 
not registered, but dark counts occur, it is possible that the outcomes are incorrectly correlated. 
Taking into account all possibilities yields 

Pincoueci^d^^'^'^\2£nn{M-l)d + erfcfM{M- l) + ecfM{M-l% (29) 

and 

P^on^ci^d^^ [en^ + '2-£nr]d + £lf-cf-M + £cf-M], (30) 



where the overbar notation x= 1 — x denotes the probabilistic complement. The common factor 

of d^^*' represents the probability that there is no dark count in the M — 1 remaining bins on 
each side, and this factor cancels out in the expression for p. After some algebra, one obtains 



the expressions in Eq. (23 i. 
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